yashsingh1/xdaforums huggingface dataset:
[Nexus 7 (2013) Q&A] k23m:
So the 'aboot' partition is writeable, great!

There might be a method of booting twrp from a locked bootloader but it has never been tested. I found CVE about a bug in old bootloaders:

I am not sure if your current bootloader would allow a downgrade, nor if the rest of bootloader's partitions are writeable, but your tests would be most appreciated.

It may kill your bootloader completely

but at this stage there isn't much to lose. So with the above in mind, if you wish to try it, then please do:

download the oldest factory image (v4.3) for your N7

extract 'bootloader-flo-flo-03.14.img' from it

run fastboot flash bootloader bootloader-flo-flo-03.14.img

If OK, then boot TWRP :fingers-crossed:

Again...

It may kill your bootloader completely

!!!
[Nexus 7 (2013) Q&A] k20-:
Looks like I can't flash anything when the bootloader is locked.

D:\android-sdk\platform-tools>fastboot flash bootloader bootloader-flo-flo-03.14.img

sending 'bootloader' (3911 KB)...

FAILED (remote: Bootloader is locked.)

finished. total time: 0.009s
[Nexus 7 (2013) Q&A] k23m:
Yes, it was a desperate experiment :)

We run out of ideas. If you are in the US then the link to second-hand $25 mobo in my first post is probably your best option. If you find a cheaper one, please let me know and I will update the link.

Finally, if or when you replace the motherboard, please note the maker of the failed eMMC and post it here. Thank you in advance.
[Nexus 7 (2013) Q&A] k20-:
I have a 32Gb version. The 16Gb version might not be compatible from what I understand (I could be wrong, I see other people asked if they could swap 16Gb to 32Gb and it didn't seem to work. So I guess the reverse would apply too). Ifixit seems to stock those 32Gb mobo's but right now they are out of stock. I thought about ordering a used one from Ebay (there are a few listed for about $70-$80 USD right now). I don't know if it's worth to fix a 3-year old device. I've seen people from different forums sending their devices back to Asus or Google for repair with hard bricked conditions and they could fix them. I just don't know how. It got to be a way and nobody seems to know. Thanks for trying anyway.
[Nexus 7 (2013) Q&A] k23m:
I see no 16/32GB incompatibility, but wait for comments from graphdarnell and consumer61. They did a number of mobo swaps, including those sourced from the eBay link.

As for ASUS service, all returned, repaired units have different serial numbers, confirmed on all user reports I have read, so they also replace motherboards.
[Nexus 7 (2013) Q&A] micl9:
I swapped from a bad 32 to a good 16 with no issues. Both were rev e HDW
[Nexus 7 (2013) Q&A] Carrick Glen:
my story ;)

Hi. Bricked my N7 in January, while downloading a 4.3GB movie via totalcomander/wifi. It suddeny rebooted and never managed to go past the google logo. Unfortunatley i have no idea which chip it was. However: i got it replaced for free, except they broke the plastic back :/

Now it is a Kingston from July 2013. Serialnumber changed as the MOBO was swapped.

I bought a new N7 too, it has a Hynix chip, from November 2015.

All of them are HW version E
[Nexus 7 (2013) Q&A] k23m:
It could be worse ;)

Thank you for your report, I updated our stats.
[Nexus 7 (2013) Q&A] Axel85:
I have an hynix emmc... No problems so far
[Nexus 7 (2013) Q&A] k23m:
2013 or 2015 manufactured?

If 2015, please run and post: adb shell head /sys/block/mmcblk0/device/* > data.txt
[Nexus 7 (2013) Q&A] Axel85:
May 2013
[Nexus 7 (2013) Q&A] graphdarnell:
I've never encountered an incompatibility problem between 16GB and 32GB. The only difference I've noticed so far is the internal storage size, evidently.

BTW, I finally got the USB board (see thumb below) and it works fine. I cannot, however, do the memory dump with QPST since it's almost impossible to hold all 3 buttons with the back cover off. But I'll try to make use of the working 16GB board that has the connector ripped off. I'll report back how it goes later.

Also, I bought 2 of those USB boards and am willing to donate it to whoever living in the US who needs one. Just contact men and I'll mail it out.
[Nexus 7 (2013) Q&A] k23m:
Great news! There is another way of entering the 9008 mode; when off, hold both volume buttons and connect USB but it may not be much easier :laugh:

The daughterboard can be removed permanently and your USB PCB could be fixed there with hot glue, I suppose.

Is it unlocked? Does it show the Google logo?
[Nexus 7 (2013) Q&A] ticoticox3000:
may I feel like there is no easy solution to this problem?, the only way to solve it is by disassemble the device?, If I want to send it to Asus what should I say?
[Nexus 7 (2013) Q&A] graphdarnell:
The MB is locked. When trying to unlock, it's stuck at "erasing user data...." It does show the Google logo but won't go beyond that. Fastboot oem uart-on does finish but upon restarting, it stops at the Google logo again, obviously. It won't go into 9008 mode whether with both volume buttons pressed; or all 3 pressed.
[Nexus 7 (2013) Q&A] k23m:
What's the log of fastboot format cache ?
[Nexus 7 (2013) Q&A] k23m:
Please check fastboot getvar version-bootloader
[Nexus 7 (2013) Q&A] graphdarnell:
Flo-04.04.

Funny thing is Ubuntu would recognize the device in fastboot, and can issue all commands to it; whereas Win7 would only report "usb device not recognized," no matter what drivers are there. I know they are good since the PC does communicate with the other MB without problems. Any idea?
[Nexus 7 (2013) Q&A] ticoticox3000:
none, it just do nothing, I tried Nexus tools kit and it said fastboot getvar lock_state

My version-bootloader is

Flo-04.05
[Nexus 7 (2013) Q&A] k23m:
Older bootloaders had a nice bug which would allow us to boot TWRP from a locked N7 :D

Let's see what VID-PID is problematic in your Win7. Connect N7, run Microsoft USBView and post device descriptors, eg:

idVendor: 0x04D9
idProduct: 0x1603
bcdDevice: 0x0310
[Nexus 7 (2013) Q&A] k23m:
Your bootloader is the most recent and we can not run TWRP on a locked device to get conclusive diagnostics of your N7, however everything you reported is indicative of eMMC chip failure. If you can not claim a warranty repair, you can fix it yourself for around $25 (read my first post).
[Nexus 7 (2013) Q&A] graphdarnell:
The thumb below is all I get from USB view
[Nexus 7 (2013) Q&A] graphdarnell:
Device Descriptor:

bcdUSB: 0x0000

bDeviceClass: 0x00

bDeviceSubClass: 0x00

bDeviceProtocol: 0x00

bMaxPacketSize0: 0x00 (0)

idVendor: 0x0000

idProduct: 0x0000

bcdDevice: 0x0000

iManufacturer: 0x00

iProduct: 0x00

iSerialNumber: 0x00

bNumConfigurations: 0x00

ConnectionStatus: DeviceFailedEnumeration

Current Config Value: 0x00

Device Bus Speed: Low

Device Address: 0x00

Open Pipes: 0
[Nexus 7 (2013) Q&A] k23m:
Wow, I've never seen anything like this! If you're dual booting Ubuntu on the same PC please post lsusb log when N7 is connected to Linux.
[Nexus 7 (2013) Q&A] graphdarnell:
Showed as follows:

darnell@darnell:~/ADB-fastboot/ADB$ sudo ./fastboot devices
05e751a9	fastboot
darnell@darnell:~/ADB-fastboot/ADB/7-31-recoveries$ lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 002: ID 08ff:2580 AuthenTec, Inc. AES2501 Fingerprint Sensor
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 004: ID 18d1:4ee0 Google Inc.
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
[Nexus 7 (2013) Q&A] ticoticox3000:
Is there any idea of what cause this problem? I mean it seem very weird that many N7 stop working at the same time, I think it was cause by the last SO update.

What do you know?
[Nexus 7 (2013) Q&A] k23m:
Yes - Kingston
[Nexus 7 (2013) Q&A] k23m:
Bricked flash memory data recovery test

What if we modify the Android kernel and force it to work with bricked eMMC in read-only mode? Then we could at least recover user data from it. That's why I bypassed a few error checking functions in the kernel, then recompiled and assembled it into a custom TWRP. As I have no bricked device, I can not test it myself. The custom TWRP works normally on a non-bricked Nexus, except it can not be flashed because it is too big for the partition. Please do the following if your Nexus is

unlocked

:

download get-logs.zip to a FAT32 flash drive

download twrp-3.0.2-0-flo-mmc.img to your folder with fastboot and adb apps

boot the Nexus in fastboot mode (when off press power+vol.dn), connect it to your PC

on PC run: fastboot boot twrp-3.0.2-0-flo-mmc.img

connect the flash drive to your N7 with OTG adapter

when TWRP is up,

within 1 minute

go: install/select-storage/usb-otg/get-logs.zip/flash

logs.tgz will be saved on the flash drive

attach logs.tgz here

If you don't have an OTG adapter then try:

download twrp-3.0.2-0-flo-mmc.img to your folder with fastboot and adb apps

boot the Nexus in fastboot mode (when off press power+vol.dn), connect it to your PC

on PC run: fastboot boot twrp-3.0.2-0-flo-mmc.img

when TWRP is up,

within 1 minute

on PC run in the following order:

adb shell dmesg > dmesg.txt
adb shell dd if=/dev/block/mmcblk0p29 of=/metadata
adb pull /metadata metadata

Find 'dmesg.txt' and 'metadata' files in your adb folder, attach them here.

It is possible that you can not find 'metadata' because it is a recovery test and it may not work just yet.

Thank you in advance.
[Nexus 7 (2013) Q&A] FedorGavriLove:
Hello guys, who knows where to find good emmc for replacing. I only know that HTC one m7 and Lumia 920 is compatible. But theres no new ones on ebay and aliexpress
[Nexus 7 (2013) Q&A] k23m:
You need FBGA169 packaged chip.

If your N7 is 2013 produced, get eMMC v4.5

If your N7 is 2015 produced, get eMMC v4.5 or v5.0

http://www.alibaba.com/trade/search?SearchText=emmc+32gb
[Nexus 7 (2013) Q&A] Deksloc:
Hi kk23m,

I just tried to update to 6.0.1 from 6.0 and ended up with this "No command." problem. I'd like to help you with your testing (and selfishly I'd like to preserve my data), so my dmesg.txt is attached, and the other two files are here: metadata logs.tgz.

As an aside, would it be possible to backup my data, including the sdcard (it's internal on the N7) data using TWRP and then restore it after flashing a factory image?
[Nexus 7 (2013) Q&A] k23m:
Hello Deksloc, thank you a lot for the logs and your test of the experimental kernel - I really appreciate it! Luckily there is nothing wrong with your eMMC and the problem can be easily fixed. The OS run out of disk space on the /system partition:

Installing update...
Source: google/razor/flo:6.0.1/MMB29V/2554798:user/release-keys
Target: google/razor/flo:6.0.1/MOB30D/2704746:user/release-keys
Unpacking new system files...
minzip: Error writing 1046 bytes from zip file from 0xbebc623c: No space left on device

Filesystem Size Used Available Use% Mounted on
/dev/block/mmcblk0p22 827.8M 827.7M 100.0K 100% /system

Boot TWRP, connect an OTG flash drive and backup your data.

Then try a 'dirty' flash of 'system' partition only which should fix the problem and preserve your data (but you must wipe Dalvik/ART/Cache in Advanced Wipe)

If it does not work, then flash the entire system image and later restore your data.
[Nexus 7 (2013) Q&A] Deksloc:
I understand what you're saying to do, but I don't quite know what system image I should be flashing to it. Do I download that somewhere? Sorry to be a bother.

I didn't know this could happen. Are there any things I should do for the future to keep it from happening besides keeping a certain percentage of space available? I would have thought Android would do a check before allowing the update to take place if this were a possibility.
[Nexus 7 (2013) Q&A] k23m:
No worries, do:

from https://developers.google.com/android/nexus/images#razor

download MOB30D https://dl.google.com/dl/android/aosp/razor-mob30d-factory-15169856.tgz

keep extracting it until you find boot.img and system.img files

copy the two files to your adb/fastboot folder

boot the Nexus in fastboot mode (when off press power+vol.dn), connect it to your PC

on PC run: fastboot flash boot boot.img

on PC run: fastboot flash system system.img

on PC run: fastboot boot twrp-3.0.2-0-flo-mmc.img

when TWRP is up, go: Advanced Wipe - wipe Dalvik/ART/Cache

Next, reboot your N7. If it does not work then follow the official instructions (erases user data).

As for why it run out of disk space I can only speculate that the first version of MOB30D was buggy and initially it was removed from Google downloads.

:good:
[Nexus 7 (2013) Q&A] Deksloc:
Thank you so much! That solved the problem! For some reason, the OTA update still wants me to update, but I can ignore it until the next version of Android makes it to the N7. I haven't found the location of the downloaded file so I can't delete it, but it's not an issue.
[Nexus 7 (2013) Q&A] k23m:
Great news! Let's try to fix the OTA update prompt because it should not be there now.

"when TWRP is up, go: Advanced Wipe - wipe Dalvik/ART/Cache"​

It's not a precise description. It should be: - wipe Dalvik / ART Cache and Cache

so there are

two

items to wipe. It should fix the OTA prompt, I hope. Let me know.
[Nexus 7 (2013) Q&A] k23m:
eMMC chip replacement

Here is an interesting XDA article about eMMC chip replacement. Keep in mind that our device has

no available

in-circuit software programming method yet, so you will have to pre-program a new eMMC chip before replacement or use JTAG after replacement.

There are two ways of eMMC BGA chip replacement: the proper way and the improvised way :cowboy:. Either way, lots of practice is required.

If you have done it successfully, please post your observations.

:good:
[Nexus 7 (2013) Q&A] ticoticox3000:
I finally get to boot twrp, on it I was unable to mount any partition or make any wipe, so how can I sent it to ASUS? haha

Also my Internal Storage (0 MB)

I also noticed that my battery keeps on 27% now it is on 25%.

There is my dmesg.txt file
[Nexus 7 (2013) Q&A] k23m:
Please boot this modified TWRP and you may find that Internal Storage is back to normal capacity. Preferably, collect the logs on OTG flash drive...

:fingers-crossed:
[Nexus 7 (2013) Q&A] ticoticox3000:
At first it says: Keep System Read only?, and my Internal Storage still 0 MB
[Nexus 7 (2013) Q&A] k23m:
Keep it read-only. Get the logs as soon as possible when TWRP is up and running.
[Nexus 7 (2013) Q&A] Cobra11Murderer:
Thanks for this thread it has a lot of info I was looking for on this issue.. my buddies tablet died about a year ago me and him got our Nexus 7s almost at the same time.. he bought his new I bought mine refurb a few months later.. I'm the one that has flashed Roms and all and his died quicker than mine.. after reading I have found out I am rocking a Kingston.. I'm very surprised to see it still working as I was one of the first to install 5.0 and 5.1 when it came out for it and now for sure won't keep anything important on here unless I got it backed up just in case
[Nexus 7 (2013) Q&A] bvramana:
"Very Useful Information"

What a superb consolidated information it was, very clear and detailed and most useful:good:

Thanks a lot to share this valuable info along with pictorial representations. :svetius:
[Nexus 7 (2013) Q&A] purian23:
Bricked N7

Hello [MENTION=7182780]k23m[/MENTION]

Thank you for this very informative thread. I too am in the same boat as many with a bricked Nexus 7 2nd Gen. I have attached my dmesg logs. I am unable to fastboot flash anything to the device, or fastboot erase. It usually ends in a write error unknown and or cannot calculate space. I was able to boot your twrp, but it's not able to do anything other than shows 0mb of space. If there's anything else you can think of I'd be very grateful.

Thank you,

EDIT: I was also able to run your logs.zip with OTG and Twrp
[Nexus 7 (2013) Q&A] k23m:
Hi purian23, thank you for the very first OTG log from a bricked device on this forum. I will make further modifications to the experimental twrp and hope that you will have the time to try it out again. When it is ready I will PM you.

My twrp does not disconnect erroneous emmc and attempts to use it anyway. Note standard kernel's log:

proc_last_kmsg
[7.187408] mmcblk0: error -110 sending stop command, original cmd response 0x940, card status 0x2400e40

and my twrp...

dmesg.txt
<6>[5.446258] mmc0: new HS200 MMC card at address 0001
<6>[5.460052] mmcblk0: mmc0:0001 MMC32G 28.8 GiB

We know now that you have Kingston eMMC (the MMC32G code) which really has serious manufacturing defects. I added your Kingston to our bricked eMMC statistics.
[Nexus 7 (2013) Q&A] purian23:
Thank you for taking the time to look at this. I'll surely test out and try any ideas you come up with to help hopefully my situation and others in the future!
[Nexus 7 (2013) Q&A] dawka7:
i have bricked eMMC nexus 7 2013 mainboard. I ordered second one mainboard and changed it. If You want i can send you bricked one for tests. maybe you will find some Solutions for all of us...
[Nexus 7 (2013) Q&A] k23m:
Thank you for your offer, please check my PM to you.

What is the maker of eMMC chip on this bricked motherboard?
[Nexus 7 (2013) Q&A] ali1234:
Here is a dmesg with your custom recovery. I don't have a OTG device so this is all I could get. I can't read anything from any of the partitions. They all give I/O error. This is a Kingston 32GB.
[Nexus 7 (2013) Q&A] ali1234:
I tried "oem uart-on" and it worked. The setting was stored across reboots.

Then I started probing the "JTAG" port. It carries the UART-TX signal and probably RX too (resistors are left out though). There are a bunch of data lines pulled up to 1.8V. Probing them crashed the device, so they are very likely to be JTAG.
[Nexus 7 (2013) Q&A] k23m:
Rx is indeed available - on pin #1 - and I did connect to it.

But it is much easier via the headphones jack.
[Nexus 7 (2013) Q&A] ali1234:
Here is the emmc.txt and picture of the emmc chip package with part number.

I probed a group of pads near the eMMC and I saw data on them whenever I issued "fastboot reboot-bootloader" but when I booted twrp and tried to access the emmc they are completely silent.

There are nine lines in the group. CMD + 8 DATA maybe? They are 1.8V and the empty pads seem to be for pull up resistors. Only one is actually installed, perhaps that is CMD or CLK? There is another line nearby which could be the other one of CMD or CLK? The pads are in the right general area for this, as compared to the eMMC pin out.

It is strange though that I don't see any traffic here after booting the kernel.
[Nexus 7 (2013) Q&A] k23m:
Thank you for the info - how did your Kingston fail, was it after OTA/flashing?

If you use standard TWRP you will not see any traffic because the kernel detects eMMC error and turns it off.

If you try my TWRP you may see more traffic because the modified kernel continues despite eMMC errors.
[Nexus 7 (2013) Q&A] ali1234:
I don't know how it failed. I bought it on Ebay already broken.

I am using your TWRP.

I just found a partial pinout for those pads on a Russian forum which confirms it is the eMMC CMD and DATA. I've ordered a 1.8V level shifter and I'll hook it to my logic analyser and see what it is doing.

If we can hold the main CPU in reset using JTAG SRST then we can directly bitbang the eMMC in SPI mode to dump/flash it or any other commands.
[Nexus 7 (2013) Q&A] ali1234:
I tried talking directly to the eMMC but I could not get it to work. It seems like the CPU is holding the various lines high/low and I can't override it. Clock seems to be the main problem.

Attached is a hi res board picture showing where the signals are. I think these are right but not sure since I never got it to work.
[Nexus 7 (2013) Q&A] k23m:
Your efforts, if successful, might result in an alternative method to JTAG eMMC programming, but you'd have to experiment on a fully functional memory chip. Your eMMC according to the dmesg is suffering from constant I/O errors and basically is no longer able to write reliably. You can confirm this diagnosis by issuing the following command:

fastboot format cache

If the command never completes and just hangs, then what hope is there for direct bitbang of the faulty chip? We already have complete 32GB dumps of the flash obtained from working units but there is no way to write it to defective eMMC of course. You have to replace it first.

:good:
[Nexus 7 (2013) Q&A] ali1234:
The eMMC works to some extent, which leaves some unanswered questions:

1. How is the bootloader able to be loaded?

2. How is the bootloader able to store the UART enable bit?

3. Why does the chip become completely unreadable after booting recovery?

4. Why do so many kingston chips fail in exactly the same way?

5. How do we flash the new eMMC after replacing it without buying a $200 JTAG cable that only works with Windows?

Anyway I don't think there is any more I can do with the current equipment I have.
[Nexus 7 (2013) Q&A] k23m:
1. How is the bootloader able to be loaded?

because reading from faulty eMMC is still possible - consider it as read-only mode

2. How is the bootloader able to store the UART enable bit?

not all eMMC flash blocks/sectors are unwritable, its controller has run out of spare blocks, but it still works on some sectors

3. Why does the chip become completely unreadable after booting recovery?

unlike the bootloader aka 'lk' kernel, the Android (recovery) kernel has much more complex/strict eMMC initialization code (I did progress in discarding some of the errors in my test TWRP) and immediately rejects it after the very first error

4. Why do so many kingston chips fail in exactly the same way?

bad batch, Kingston is a hit-or-miss. I wrote earlier:

"NAND flash has limited lifespan and we can expect reliability variations among different manufacturers. Unlike fabless Kingston, Hynix actually produces NAND flash memory. Kingston is known for repackaging B-grade chips of reputable manufacturers and bait-and-switch sales."

5. How do we flash the new eMMC after replacing it without buying a $200 JTAG cable that only works with Windows?

actually before replacing it, we can program a new chip using a number of common programmers which may not be cheaper but can be hired/borrowed/etc

:highfive:

Good luck and let us know about any new developments.
[Nexus 7 (2013) Q&A] ali1234:
This does not match my observations. What actually happens is that at some point the chip stops responding to any command, including reset/sleep/wake. The kernel does not reject the device, the device completely stops responding. It won't reply to any message until it is hard reset. That's why it gives -110 errors (ETIMEDOUT) rather than -84 (EILSEQ). It would be revealing to know the exact point where this happens, but at that point the comms are running at ~50MHz which is too fast for my scope or my logic analyzer to decode.

The problem seems to be nothing in the kernel itself, but rather that TWRP tries to automount the partitions on boot. That triggers a write which seems to cause the chip to lock up.
[Nexus 7 (2013) Q&A] DaWeIII:
Hi,

I'm a Nexus 7 bricked user too.

I can get into de 9008 Qualcom Download "new mode", but windows Disk managment hangs out and nothing can be done, but Qualcom Massive Storage device is shown on Device Manager.

Here comes my CODERAM.BIN. View attachment CODERAM.rar

I can enter into Bootloader and recovery, but cannot do anything as my device is Bootloader locked. Recovery shows a lot of partition unable to mount, involving cache too.

Thanks for your help!
[Nexus 7 (2013) Q&A] k23m:
Hello DaWeIII, thank you for the CODERAM and your observations on 9008/9006 modes. Please post the output of:

fastboot oem gpt-info

fastboot format cache​

If you get "partition[30].size 27852783 KB" then your eMMC chip is Kingston.

If the format freezes on "Created filesystem...." then the chip needs to be replaced.